T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:279- Finding
Persistent Agent Memory Poisoning Through Unvalidated Writing Preferences
- Content
View full analysis
- Remediation
View remediation
Security audit
说人话
Security checks for vulnerabilities and agentic risk
Overview
This writing skill is coherent, but it should be reviewed because it automatically stores and reuses a persistent writing-style profile without clear consent or deletion controls.
Install only if you are comfortable with the skill maintaining a persistent writing-style profile in `/workspace/memory/evolution/user-writing-style.md` and using web searches for topic background. Avoid using it on confidential drafts unless the memory behavior is changed to require explicit approval, store only structured preferences, and provide inspect/delete controls.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires extracting features from every user revision and appending them to a persistent file, effectively building a behavioral profile over time. This is dangerous because it creates ongoing tracking and retention of user-generated content patterns without clear notice, purpose limitation, or deletion controls, increasing privacy and cross-session leakage risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and overlap with ordinary writing requests such as polishing, generating text, or making content sound more human. Overbroad activation can cause the skill to run in contexts the user did not intend, which is especially risky here because the skill also performs web access and persistent memory operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs persistent storage of a user's writing-style preferences in
/workspace/memory/evolution/user-writing-style.mdwithout any stated consent flow, retention limit, or necessity justification. This creates unnecessary long-term collection of behavioral/profile data that could later be exposed to other skills, logs, or operators.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes persistent storage of user writing-style preferences but does not present a clear user-facing warning or consent mechanism. Hidden retention of preference/profile data undermines user expectations and can lead to privacy harm if that data is later accessed, reused, or leaked.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill adds network access for date lookup and background research, which expands capability beyond pure text polishing into web-enabled data collection. While not inherently malicious, unnecessary external access increases attack surface, may transmit user topics to third parties, and can cause the agent to retrieve or rely on untrusted content.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persistent logging of user writing traits, edits, and evolving preferences into memory files creates a natural-language data retention risk. Free-form text profiles can capture sensitive or identifying details inadvertently, and once stored, they may be exposed across sessions, to other components, or through improper file handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatically updating a user profile file after edits amounts to silent profiling of user behavior and preferences. Because no clear privacy warning or approval step is described, users may unknowingly contribute sensitive stylistic or contextual information to persistent storage.
- Content